What you are going to build
The Agent Governance Toolkit is the piece that sits between an agent deciding to call a tool and the tool actually running. The agent says refund this order; the toolkit decides whether that is allowed, records what happened, and either lets the call through or stops it. This course builds that for one shop agent, and every lesson runs on your machine with no API key and no cloud account.
An agent that can call tools can do damage. It can refund the wrong order, email the wrong person, or delete a record because a customer asked it nicely. Governance is the layer that makes those calls answerable to a rule instead of to a sentence the model produced.
Governance, working
from agent_control_plane import AgentKernel, PolicyEngine
from pretend_agent_governance import PretendAgent, TOOLS
policy = PolicyEngine()
policy.add_constraint("support", ["lookup_order", "issue_refund"])
kernel = AgentKernel(policy_engine=policy)
agent = PretendAgent()
for message in ["Where is order A17?", "please delete order A17"]:
tool, args = agent.decide(message)
verdict = kernel.intercept_tool_execution("support", tool, args)
print(tool, "->", "allowed" if verdict is None else "blocked")The agent chose both calls on its own. The second one never ran, because delete_order is not on the list of tools this agent is allowed to use. Nothing about the agent changed to make that happen.
pretend_agent_governance is a shop agent you write in lessons 1 and 2. The Agent Governance Toolkit governs tool calls, so the course needs something making them; a forty-line router that reads a message and picks a tool is enough, and it means no part of this course needs a model.
No API key, and no Azure either
The Agent Governance Toolkit is published by Microsoft under the MIT licence. A policy engine deciding whether a call is allowed is pure logic, so the whole of it runs offline. This course was written with the network blocked to prove that.
Some of the wider stack does need more than pip: the sandbox providers want Docker or Azure, and the newest policy layer needs a Rust build and the OPA binary. Lesson 29 names those and says what each one needs.
What you will have built
| Piece | What it does | Lesson |
|---|---|---|
| A shop agent | Decides which tool to call, with no model | 2 |
| The choke point | Every tool call passes through one gate | 4 |
| An allow-list | Everything is denied unless named | 5 |
| Policy files | Rules in YAML instead of in Python | 10 to 14 |
| Conditional rules | Allowed only when the context agrees | 15 and 16 |
| A flight recorder | A tamper-evident record of every call | 20 to 22 |
| Shadow mode | Watch a policy before it blocks anything | 23 |
| A CI gate | Lint and replay policies before they ship | 25 and 26 |
| A governed agent | All of it, around one support agent | 30 to 32 |
By lesson 32 there is a support agent whose every tool call is checked against a policy file, recorded in a log that cannot be edited without detection, and testable in CI before it ships.
Every expert started right here.